In this article
The role
What does a SOC analyst do?
A SOC analyst monitors alerts, decides which are real, investigates them and escalates or closes each one with a written reason. The U.S. Bureau of Labor Statistics (BLS) describes the wider occupation of information security analysts as people who "plan and carry out security measures to protect an organization's computer networks and systems", and projects 21 percent employment growth from 2025 to 2035, much faster than average (BLS, last modified August 2026).
Why it is asked: it checks that you know the job is judgement on alerts, not only tools. Read more: how interview loops are structured.
What is a security operations center, and how are analysts usually tiered?
A security operations center is the team, process and tooling that monitors an organization continuously and responds to security events. Many teams split analysts into tiers: a first tier triages alerts, a second tier investigates and contains, and a third tier hunts threats and builds detections. Names and boundaries differ by employer, so ask how this team divides the work.
Why it is asked: it shows you understand where the role sits and what you would hand off.
Why do you want to work in a SOC?
Give a reason rooted in the work: you like turning ambiguous signals into a clear call, you enjoy learning how attacks behave, and you accept shift work and repetition. Add one concrete example, such as a home lab, a capture-the-flag event or a log you traced to its cause. "I like hacking" alone says little about defensive work.
Why it is asked: SOC work is repetitive, and motivation predicts how you handle it. Read more: how to answer interview questions.
Detection basics
What is the difference between a security event and an incident?
An event is any observable occurrence in a system or network, and an incident is an occurrence that actually or potentially jeopardizes the confidentiality, integrity or availability of a system or its information, or violates security policy. The first definition comes from NIST Special Publication (SP) 800-37 Rev. 2 and the second from the Federal Information Processing Standards (FIPS) publication 200, both in the NIST glossary. Most events are harmless; a SOC exists to find the few that are incidents.
Why it is asked: it tests whether you separate noise from threat.
What is a SIEM, and how do you use one?
A security information and event management (SIEM) system is software that collects logs from many sources, normalises them, correlates them and raises alerts. As an analyst you use it to search the logs around an alert, build a timeline across sources such as endpoints, firewalls and identity systems, and check whether a detection rule fired for a good reason. Say which SIEM you have used and what you searched for.
Why it is asked: SIEM search is the daily tool in most SOCs.
What are true positives, false positives and false negatives?
A true positive is an alert for activity that really is malicious. A false positive is an alert for harmless activity, and a false negative is malicious activity that raised no alert. Analysts close false positives with a reason and report repeated ones so the rule can be tuned. False negatives are the dangerous case because nobody is looking, which is why threat hunting exists.
Why it is asked: it shows you think about detection quality, not only alert volume.
What is the difference between an IDS and an IPS?
An intrusion detection system (IDS) watches traffic or hosts and raises alerts. An intrusion prevention system (IPS) sits in the traffic path and can also block what it flags. The trade-off is risk: an IPS that blocks a false positive can interrupt legitimate business, so teams tune rules in detect-only mode before enabling blocking.
Why it is asked: it tests basic network security vocabulary and the cost of automation.
What is endpoint detection and response (EDR), and what do you check on an alerting host?
Endpoint detection and response (EDR) is software on a laptop or server that records process, file, network and logon activity and lets analysts investigate and contain the machine remotely. On an alerting host check the process tree (what started what), the command line, the user, network connections, persistence such as new scheduled tasks, and whether the same file appears on other hosts.
Why it is asked: endpoint evidence is where most alerts are confirmed or cleared.
What is the difference between a precursor and an indicator?
A precursor is a sign that an incident may occur in the future, and an indicator is a sign that an incident may have occurred or may be occurring now. NIST gives a vulnerability scanner appearing in web server logs as a precursor example (NIST SP 800-61 Rev. 2, 2012). The same document warns that an accurate indicator does not always mean an incident, because a server crash can also be human error.
Why it is asked: it tests whether you avoid both panic and complacency.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →Investigation
How do you triage an alert?
Read what the rule detects, check the asset and user involved, and decide quickly how severe it could be if true. Then gather context from the logs around the time, look for the same indicator elsewhere, and make a call: close as a false positive, escalate, or keep investigating. Write down what you checked and why, so the next analyst does not repeat it.
Why it is asked: triage is most of the first-tier job.
Text description of the diagram
- A SOC analyst triages alerts, investigates the real ones and escalates or closes each with a written reason.
- Write down what you checked and why, so the next analyst does not repeat it.
How would you investigate a suspected phishing email?
Do not open links or attachments on a normal machine. Check the sender address and the reply-to against the display name, read the message headers for the true sending path, and inspect links and attachments in a sandbox or through a reputation lookup. Then find who else received it, who clicked, and whether any credentials were entered. Block the sender and links, reset exposed accounts and report the result.
Why it is asked: phishing is the most common alert type a new analyst sees.
You see many failed logons followed by a success. What do you do?
Treat it as possible password guessing that worked. Look at the failed-logon events (Windows event 4625), the source address, the target account and the logon type, then find the success (event 4624) for the same account and address. Check whether the source is unusual, whether the account is privileged, and what the session did next. If the account looks taken over, escalate and reset it.
Microsoft's documentation lists logon type 3 as a network logon and type 10 as a remote desktop logon, and says status 0xC000006A means a bad password (Microsoft Learn, 2026).
Why it is asked: it tests whether you can chain two log events into a story.
How do you tell a brute-force attack from a user who forgot a password?
Compare the pattern, not one event. A forgetful user produces a few failures for one known account from a usual device, then a success. An attack shows many failures across many accounts or in a tight burst, often from one new source. Microsoft's guidance says several "bad user account" failures in a row, status 0xC0000064, can signal a user enumeration attack (Microsoft Learn, 2026).
Why it is asked: it tests judgement about baselines.
What is MITRE ATT&CK, and how do you use it in a SOC?
ATT&CK, short for Adversarial Tactics, Techniques, and Common Knowledge, is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations (attack.mitre.org, version 20 as of October 2026). Analysts use it as a shared vocabulary: map an alert to a technique, see what attackers usually do next, and check whether your detections cover each tactic. Name a technique you have studied rather than reciting the matrix.
Why it is asked: it shows you can reason about attacker behaviour, not only signatures.
Response and judgement
What are the phases of incident response?
NIST SP 800-61 Rev. 2 describes four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Revision 3, published in April 2025, supersedes it and recasts incident response as part of the NIST Cybersecurity Framework 2.0 risk-management activities (NIST SP 800-61 Rev. 3, April 2025). Say the phases, then say where an analyst's work sits: mostly detection and analysis.
Why it is asked: it tests whether you know the process behind the tickets.
What do you do first when you confirm a host is compromised?
Contain it without destroying evidence: isolate the host from the network through the EDR or network controls rather than powering it off, record the time and what you saw, preserve logs and any memory or disk capture your procedure calls for, and tell your lead. Wiping or rebuilding comes after the investigation, because it removes the proof of how the attacker got in.
Why it is asked: it separates stopping damage from losing evidence.
When and how do you escalate an incident?
Escalate when the impact is beyond your authority or your tier's playbook: a privileged account, sensitive data, spread to several hosts or a business-critical system. Give the next person the alert, what you checked, what you found, what you did and what you need, in a few lines. Escalating early with a clear note is better than finishing alone and late.
Why it is asked: it tests ownership, communication and knowing your limits. Read more: telling your story in an interview.
What belongs in an incident ticket or a shift handover?
Record the alert, the time, the affected assets and users, the evidence you checked, your conclusion, the actions taken and what remains open. Write it so a colleague can pick it up cold. A good handover also states what you are waiting for and by when, and which alerts you suspect need tuning.
Why it is asked: documentation is the part of the job that scales.
How do you cope with alert fatigue?
Be systematic and make the noise visible. NIST notes that an organization can receive thousands or even millions of intrusion detection sensor alerts a day (NIST SP 800-61 Rev. 2, 2012). Work by severity, close repeats with a reason, track which rules produce the most false positives, and propose tuning to the detection engineers rather than silently ignoring a rule.
Why it is asked: fatigue causes missed incidents, so teams hire people who manage it.
Tell me about a time you found something that others missed.
Use the situation, task, action, result (STAR) structure: the context, what you were responsible for, the specific steps you took, and the outcome. A home lab, a course exercise or a previous help-desk case is fine. Say what you noticed, why it mattered and what you changed afterwards. Keep the focus on your reasoning, not on the tool.
Why it is asked: it is a behavioural check on curiosity and follow-through. Read more: the STAR method and behavioural interviews.
Follow-up questions
How do I prepare for a SOC analyst interview?
Learn the alert-to-ticket workflow end to end, practise reading Windows and network logs, and be able to walk one phishing case and one failed-logon case aloud. Prepare two stories using the STAR structure, and read the employer's job post to see which SIEM and EDR products it names.
Do I need certifications to become a SOC analyst?
Requirements vary by employer. The BLS profile lists a bachelor's degree as the typical entry-level education for information security analysts, and job posts often name certifications as preferred or required, so read each posting rather than assuming.
What should I ask in a SOC analyst interview?
Ask how alerts are prioritised, which tools the team uses, how many alerts a shift handles, how detections are tuned, how shifts rotate and how analysts move to the second tier. The questions to ask your interviewer page covers the general version.
- A SOC analyst triages alerts, investigates the real ones and escalates or closes each with a written reason.
- An event is any observable occurrence; an incident jeopardizes confidentiality, integrity or availability or breaks policy.
- Chain log events into a story: failed logons, then a success, then what the session did.
- Contain a compromised host without destroying evidence, and escalate early with a clear note.
- Be ready to name an ATT&CK technique and the four phases of NIST's incident response life cycle.
Sources
- Information Security Analysts, Occupational Outlook Handbook — U.S. Bureau of Labor Statistics, 27 Aug 2026
- Computer Security Incident Handling Guide, NIST SP 800-61 Revision 2 — NIST, 6 Aug 2012
- Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, NIST SP 800-61 Revision 3 — NIST, 1 Apr 2025
- Glossary entries: incident and event — NIST Computer Security Resource Center, 24 Oct 2026
- 4625(F) An account failed to log on, Windows security auditing — Microsoft Learn, 29 Mar 2026
- MITRE ATT&CK — MITRE, 24 Oct 2026
